Last updated 15 September 2026.
This is the detail behind section 3 of the privacy policy. It lists every cookie and every browser-storage key the site sets, by name.
Two of these are cookies — small values sent back to a server. Everything else is browser storage, which is a different thing and worth understanding: it is held by your browser, it is never attached to a request, and it never reaches us. It is how the editor remembers your work without an account.
| Name | Set by | What it is for | How long |
|---|---|---|---|
stitch_session (__Secure-stitch_session over HTTPS) | us, when you sign in | keeps you signed in. HttpOnly, so scripts cannot read it, and SameSite=Lax, so it is not sent with cross-site requests | 30 days, sliding while you keep using the site; removed when you sign out |
ph_<project key>_posthog | the PostHog analytics library | identifies this browser to our analytics so that repeat visits are not counted as new people | 365 days |
The session cookie is strictly necessary — without it there is no way to stay signed in. It is not set at all unless you sign in.
The analytics cookie is not strictly necessary. We should be asking before
setting it and we do not yet; a consent banner is being built. Until it exists,
you can stop it entirely with any tracker-blocking browser extension, or by
blocking us.i.posthog.com. The analytics library is a separate download that is
never fetched if it is blocked.
The tutorials page loads video thumbnails from Google's image host. Images
cannot set cookies, and the video player we use is the youtube-nocookie.com
variant, but the request itself still reaches Google — see section 2.10 of the
privacy policy.
None of the following is ever sent to us or to anybody else.
localStorage — kept until you clear it| Key | What it holds |
|---|---|
stitch-studio-library | every design you have made in this browser |
stitch-studio-design | a mirror of the design currently open, kept for compatibility with older versions of the app |
stitch-studio-guides | ruler guides you have dragged onto the canvas |
stitch-studio-author | the author name you last typed when publishing, so the field is pre-filled |
stitch-studio-library-open, stitch-studio-library-tab | whether the library panel was open and which tab it was on |
stitch-studio-protect-prompted | that you have already been shown the one-time "your work is only on this device" reminder, so it is not shown again |
stitch-studio-import | a design being handed from the gallery to the editor. Written, then deleted as soon as the editor reads it |
sessionStorage — cleared when you close the tab| Key | What it holds |
|---|---|
stitch-studio-open-design | which design this particular browser tab has open, so two tabs can hold two designs |
stitch-studio-hint-dismissed | that you closed the hint strip under the canvas |
stitch-studio-starter-dismissed | that you dismissed the "start with…" card |
The analytics library also keeps its copy of the identifier described above in
localStorage, under the same ph_<project key>_posthog name as its cookie.
Blocking the library stops both.
Clearing this site's data in your browser removes all of the above. It also
deletes every design you have not saved to an account, and nobody can restore
them. Export anything you want to keep first — the File menu writes a
.stitch.json file and an SVG.
Questions: ceo@stitchstudioapp.com.